---
id: "GHSA-v234-4jrq-mgg6"
page: "https://infrastack.ai/live/GHSA-v234-4jrq-mgg6"
kind: "vulnerability"
aliases: ["GHSA-v234-4jrq-mgg6"]
title: "Claude Desktop (macOS): opening a malicious file from a Cowork folder could run commands on the host"
severity: "high"
cvss: 8.5
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "Claude Desktop", "fixed": ["1.15962.0"], "affected": ">= 1.1.3918, < 1.15962.0", "ecosystem": "other"}]
ecosystems: ["other"]
tags: ["ai-agents", "ai-tooling", "claude-desktop", "cowork", "cwe-184", "macos"]
not_affected_if: ["no-cowork-sessions", "version-1.15962.0-or-later"]
published_at: "2026-09-25T21:54:09+00:00"
first_seen_at: "2026-11-09T22:53:24+00:00"
updated_at: "2026-11-09T22:59:02+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/anthropics/claude-code/security/advisories/GHSA-v234-4jrq-mgg6", "first_seen_at": "2026-11-09T22:53:24+00:00"}]
exploit_sources: []
---

# Claude Desktop (macOS): opening a malicious file from a Cowork folder could run commands on the host

Link for people: https://infrastack.ai/live/GHSA-v234-4jrq-mgg6 (this .md is for agents)

Claude Desktop's block list omitted a file type that macOS executes on open, so a file written into a Cowork shared folder by a compromised or prompt-injected agent could run commands on the Mac when the user opens it from Claude Desktop. The advisory also notes a combined chain with a guest Linux kernel flaw (CVE-2026-43284) that could trigger the open without user interaction.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- other:Claude Desktop affected >= 1.1.3918, < 1.15962.0 fixed 1.15962.0

## How to check

- Check the installed Claude Desktop version in the app's About screen or the app bundle's `Info.plist`, and compare it with `1.15962.0`.
- Look for Cowork shared folders containing files of types that macOS executes on open.

## Fix

- Claude Desktop: `1.15962.0` or later (fixed version per the product data).
- Claude Desktop releases before `1.11847.5` shipped a VM image with the affected kernel; the advisory says `1.11847.5` updated it to a patched kernel.

## Timeline

- 2026-11-09T22:53:24+00:00 ghsa-repo https://github.com/anthropics/claude-code/security/advisories/GHSA-v234-4jrq-mgg6

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/anthropics/claude-code/security/advisories/GHSA-v234-4jrq-mgg6

## From the sources

Claude Desktop maintains a list of file types that execute code when opened, and prevents those types from being opened directly from a Cowork session's shared folder. This ensures that content written into the folder by an agent running inside the Cowork sandbox cannot execute on the host without the user intending to run it. On macOS, this list omitted a file type that the operating system executes on open. As a result, a file placed in a Cowork folder by a compromised or prompt-injected agent could run commands on the user's Mac if the user opened that file from Claude Desktop. Claude Desktop 1.15962.0 adds this and related file types to the block list.

Separately, Claude Desktop releases prior to 1.11847.5 shipped a Cowork VM image whose guest Linux kernel was affected by the upstream vulnerability CVE-2026-43284. Claude Desktop 1.11847.5 (released 9 June 2026) updated the VM image to a patched kernel. When the two issues were combined, code that had gained elevated privileges inside the VM could trigger the file open without user interaction; the severity rating above reflects the file-handling issue on its own. Claude Desktop 1.15962.0 and later include both changes.

Users on standard Claude Desktop auto-update have already received these fixes. Users performing manual or managed updates are advised to update to the latest version.

Identified internally by Anthropic. Also independently reported by Vladimir Tokarev (Cyera Research).

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_